FACT SHEET—MANAGING RISKS TO HEALTH
AND SAFETY AT THE WORKPLACE
This fact sheet provides general guidance for persons conducting a business or undertaking (PCBUs)
and workers on managing health and safety risks at the workplace. It is based on and should be read
together with the Work Health and Safety (WHS) Act and Regulations, the Code of Practice: How to
Manage Work Health and Safety Risks and any other applicable codes of practice or guidance material.
Managing risks to health and safety at the workplace
Managing work health and safety risks involves four steps (see figure below):
1. identifying hazards—finding out what could cause harm
2. assessing risks (if necessary)—understanding the nature of the harm that could be caused by
the hazard, how serious the harm could be and the likelihood of it happening
3. controlling risks—implementing the most effective control measure that is reasonably
practicable in the circumstances
4. reviewing control measures—ensuring control measures are working as planned.
Control measures must be selected to eliminate the risk, so far as is reasonably practicable. If
elimination is not reasonably practicable, the risks must be minimised so far as is reasonably
practicable.
PCBUs’ responsibility for managing risk
PCBUs are responsible for managing work health and safety risks. Sometimes several PCBUs may
share responsibility with other business operators who are involved in the same activities or who share
the same workplace. These PCBUs must consult, cooperate and coordinate activities with all other
persons who have a work health or safety duty in relation to the same matter, so far as is reasonably
practicable.
Tasks to manage risks may be delegated, but ultimately each relevant PCBU holds this responsibility
under the law.
Each PCBU must ensure that relevant workers and their health and safety representatives are involved
in the risk management process. PCBUs should also ensure that whoever carries out any step in the
risk management process has the necessary skills and experience to do so and understands when
specialist help might be needed.
More information and guidance on consultation is available in the Code of Practice: Work Health and Safety
Consultation, Cooperation and Coordination.
Consultation and managing risks
Consultation with workers and their health and safety representatives is required at each step in
managing risks to health and safety at the workplace. By drawing on the experience, knowledge and
ideas of workers, PCBUs are more likely to identify all hazards and choose effective control measures.
Workers should be encouraged to report any hazards and health and safety problems immediately so
that risks can be managed before an incident occurs.
If there is a health and safety committee for the workplace, it should also be engaged in managing
health and safety risks at the workplace.
Using a consultant
In most cases the relevant PCBU can carry out the risk management steps with the help of workers.
External help or advice may be necessary if there is insufficient in-house experience or knowledge, or if
risks are complex.
Managing risks–who should be covered
Risks must be managed to ensure the health and safety of workers and other people affected by the
conduct of the business or undertaking including visitors and customers at a workplace. Special
consideration must be given to vulnerable workers including:

contractors and shift workers who may not be familiar with the workplace, including the systems
of work implemented at the workplace

new and young workers who may be inexperienced or lack the maturity to recognise risks

workers with poor literacy skills—if staff can’t sufficiently read, write or add, this can affect their
ability to understand and follow guidance and instructions and expose them to greater risk

new or expectant mothers who may be more prone to health-related risks such as physical,
biological or chemical risks

persons with a disability—reasonable modifications to the workplace and work tasks may be
required to enable them to work safely.
PCBUs should also think about other people such as members of the public and groups of people who
share the workplace (for example childcare centres, nursing homes and sporting venues) when
considering how to control risks.
Four steps to managing risks to health and safety
1. Identify hazards—finding hazards and potential hazards
A hazard is anything that could be harmful to any person. Some hazards will be obvious because they
may be common to a particular industry, but others can by more difficult to identify.
Working closely with workers and looking at every task at the workplace will assist in finding potential
hazards.
Information and advice about hazards and risks relevant to particular industries and types of work is
available from regulators, industry associations, unions, technical specialists and safety consultants.
Manufacturers and suppliers can also provide information about hazards and safety precautions for
specific substances (safety data sheets), plant or processes (instruction manuals).
Analyse records of health monitoring, workplace incidents, near misses, worker complaints, sick leave
and the results of any inspections and investigations to identify hazards. If someone has been hurt
doing a particular task, then a hazard exists that could hurt someone else. These incidents need to be
investigated to find the hazard that caused the injury or illness.
Once identified, hazards should be recorded in writing.
2. Assessing the risks
A risk assessment involves considering what could happen if someone is exposed to a hazard and the
likelihood of it happening. A risk assessment can help determine:
1. how severe a risk is
2. whether any existing control measures are effective
3. the action that should be taken to control the risk
4. how urgently the action needs to be taken.
A risk assessment does not have to be complex—this will depend on the type of hazards and the
information, data and resources that are available. It can be as simple as a discussion with workers or
may involve specific risk analysis tools and techniques recommended by safety professionals.
3. Control the risks—fixing the problems
Once the hazards have been identified (and where necessary, any relevant risks assessed) start on the
most important step of all—fixing the problems.
The various ways of controlling risks can be ranked from the highest level of protection and reliability to
the lowest. This is referred to as the hierarchy of controls.
The most efficient way of controlling risks is to eliminate a hazard, so far as is reasonably practicable. If
not reasonably practicable the next step is to minimise the risks so far as is reasonably practicable, by
doing one or more of the following:
1. substituting (wholly or partly) the hazard creating the risk with something that creates a lesser
risk
2. isolating the hazard from any person exposed to it, and/or
3. implementing engineering controls.
If a risk then remains, the remaining risk must be minimised, so far as is reasonably practicable, by
implementing administrative controls. An administrative control means a method of work, a process or a
procedure designed to minimise risk, but does not include an engineering control or the use of personal
protective equipment (PPE).
Following the implementation of administrative control, if a risk still remains, then the remaining risk
must be minimised, so far as is reasonably practicable, by ensuring the provision and use of suitable
PPE. A combination of controls should be used if a single control is not sufficient for the purpose.
4. Reviewing risk controls
Controlling health and safety risks in the workplace is an ongoing process that needs to take into
account changes in the workplace. This is why procedures and risk controls must be reviewed regularly
to ensure they are still effective.
Risk control measures implemented to meet work health and safety requirements must be reviewed
and as necessary revised to maintain, so far as is reasonably practicable, a work environment that is
without risks to health or safety. This includes when:

the control measure does not control the risk it was implemented to control, so far as is
reasonably practicable

before a change at the workplace that is likely to give rise to a new or different risk to health or
safety that the measure may not effectively control

a new relevant hazard or risk is identified

the results of consultation required under the laws indicate that a review is necessary

a health and safety representative requests a review and they reasonably believe that: a
circumstance referred to above affects or may affect the health and safety of a member of the
work group they represent, and

the control measure has not be adequately reviewed.
When to assess risk
A risk assessment is mandatory for certain high risk activities such as entry into confined spaces, diving
work and live electrical work.
Although a risk assessment may not be mandatory under the WHS Regulations, it should be conducted
when:

there is uncertainty about how a hazard may result in injury or illness

the work activity involves a number of different hazards and there is a lack of understanding
about how the hazards may interact with each other to produce new or greater risks

changes at the workplace occur that may impact on the effectiveness of control measures.
A risk assessment is not necessary if:

laws already require the relevant hazards or risks to be controlled in a specific way—these
requirements must be complied with

a code of practice or other guidance sets out a relevant way of controlling a hazard or risk that is
applicable to your situation—this guidance can be followed

well-known and effective controls that are used in the particular industry, are suited to the
relevant circumstances in a particular workplace—these controls may be implemented.
New or different risks associated with a change in work systems or work location should be covered by
a specific assessment.
Deciding what is ‘reasonably practicable’
Deciding what is ‘reasonably practicable’ to protect people from harm requires taking into account and
weighing up all relevant matters including:
1. the likelihood of the hazard or the risk occurring
2. the degree of harm that might result from the hazard or the risk
3. knowledge about the hazard or risk
4. ways of eliminating or minimising the risk, and
5. the availability and suitability of ways to eliminate or minimise the risk.
It is only after assessing the extent of the risk and the available ways of eliminating or minimising the
risk, that consideration may be given to the cost associated with available ways of eliminating or
minimising the risk. A relevant factor at this point is whether the cost is grossly disproportionate to the
risk.
Keeping records
It is good practice to keep records of risk management activities while they remain relevant. Keeping
records of the risk management process demonstrates compliance and may help when undertaking
subsequent risk assessments.
For most workplace risks there is no set amount of time that records must be kept. However records for
certain high risk activities such as entry into confined spaces, diving work and live electrical work must
be kept for a prescribed period of time.
More information
More information about the risk management steps is included in the Code of Practice: How to Manage
Work Health and Safety Risks. This code includes a risk management template at Appendix B.
Disclaimer
Note: this fact sheet provides general information only and should not be used as a substitute for
seeking professional legal advice for your specific circumstances. The contents of this fact sheet are
correct and based on available information at the time of writing. However, there may be subsequent
decisions of courts or tribunals on the matter covered by this fact sheet which mean that the contents
are no longer accurate.